@agentmemory/agentmemory 0.9.17 → 0.9.18

package/dist/index.mjs

@@ -325,6 +325,20 @@ var AnthropicProvider = class {
 	}
 };
 
+//#endregion
+//#region src/providers/_fetch.ts
+function fetchWithTimeout(url, init, timeoutMs) {
+	const parsed = timeoutMs ?? Number.parseInt(getEnvVar("AGENTMEMORY_LLM_TIMEOUT_MS") ?? "60000", 10);
+	const ms = Number.isFinite(parsed) && parsed > 0 ? parsed : 6e4;
+	const ctl = new AbortController();
+	const signal = init.signal ? AbortSignal.any([init.signal, ctl.signal]) : ctl.signal;
+	const t = setTimeout(() => ctl.abort(), ms);
+	return fetch(url, {
+		...init,
+		signal
+	}).finally(() => clearTimeout(t));
+}
+
 //#endregion
 //#region src/providers/minimax.ts
 /**
@@ -360,8 +374,7 @@ var MinimaxProvider = class {
 		return this.call(systemPrompt, userPrompt);
 	}
 	async call(systemPrompt, userPrompt) {
-		const url = `${this.baseUrl}/v1/messages`;
-		const response = await fetch(url, {
+		const response = await fetchWithTimeout(`${this.baseUrl}/v1/messages`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -429,7 +442,12 @@ const DEFAULT_AZURE_API_VERSION = "2024-08-01-preview";
 *                              Azure: https://<resource>.openai.azure.com/openai/deployments/<deployment>
 *   OPENAI_MODEL             — model name (default: gpt-4o-mini)
 *   OPENAI_API_VERSION       — Azure api-version query param (default: 2024-08-01-preview)
-*   OPENAI_TIMEOUT_MS        — outbound fetch timeout in ms (default: 60000)
+*   OPENAI_TIMEOUT_MS        — outbound fetch timeout in ms (OpenAI-scoped alias,
+*                              takes precedence over AGENTMEMORY_LLM_TIMEOUT_MS
+*                              for back-compat with the v0.9.17 shipping name).
+*   AGENTMEMORY_LLM_TIMEOUT_MS — outbound fetch timeout in ms shared across all
+*                              raw-fetch LLM + embedding providers. Used when
+*                              OPENAI_TIMEOUT_MS is not set. Default: 60000.
 *   MAX_TOKENS               — max output tokens (default: from config or 4096)
 *   OPENAI_REASONING_EFFORT  — "low" | "medium" | "high" | "none"
 *                              Passthrough for reasoning models (e.g. Ollama Cloud
@@ -453,7 +471,7 @@ var OpenAIProvider = class {
 		this.maxTokens = maxTokens;
 		this.baseUrl = (baseURL || getEnvVar("OPENAI_BASE_URL") || DEFAULT_BASE_URL$1).replace(/\/+$/, "");
 		this.reasoningEffort = getEnvVar("OPENAI_REASONING_EFFORT") || void 0;
-		this.timeoutMs = parseTimeout(getEnvVar("OPENAI_TIMEOUT_MS"));
+		this.timeoutMs = resolveTimeout();
 		this.azureApiVersion = getEnvVar("OPENAI_API_VERSION") || DEFAULT_AZURE_API_VERSION;
 		this.isAzure = detectAzure(this.baseUrl);
 	}
@@ -494,21 +512,16 @@ var OpenAIProvider = class {
 			}]
 		};
 		if (this.reasoningEffort) body.reasoning_effort = this.reasoningEffort;
-		const ac = new AbortController();
-		const t = setTimeout(() => ac.abort(), this.timeoutMs);
 		let response;
 		try {
-			response = await fetch(url, {
+			response = await fetchWithTimeout(url, {
 				method: "POST",
 				headers: this.buildHeaders(),
-				body: JSON.stringify(body),
-				signal: ac.signal
-			});
+				body: JSON.stringify(body)
+			}, this.timeoutMs);
 		} catch (err) {
-			if (ac.signal.aborted || err instanceof Error && err.name === "AbortError") throw new Error(`OpenAI API request timed out after ${this.timeoutMs}ms — set OPENAI_TIMEOUT_MS to raise the bound or check the provider status.`);
+			if (err instanceof Error && err.name === "AbortError") throw new Error(`OpenAI API request timed out after ${this.timeoutMs}ms — set OPENAI_TIMEOUT_MS (or AGENTMEMORY_LLM_TIMEOUT_MS) to raise the bound or check the provider status.`);
 			throw err;
-		} finally {
-			clearTimeout(t);
 		}
 		if (!response.ok) {
 			const text = await response.text();
@@ -523,10 +536,19 @@ var OpenAIProvider = class {
 		throw new Error(`OpenAI returned unexpected response: ${JSON.stringify(data).slice(0, 200)}`);
 	}
 };
-function parseTimeout(raw) {
-	if (!raw) return DEFAULT_TIMEOUT_MS;
-	const n = parseInt(raw, 10);
-	return Number.isFinite(n) && n > 0 ? n : DEFAULT_TIMEOUT_MS;
+function resolveTimeout() {
+	const openai = parsePositiveInt(getEnvVar("OPENAI_TIMEOUT_MS"));
+	if (openai !== void 0) return openai;
+	const globalMs = parsePositiveInt(getEnvVar("AGENTMEMORY_LLM_TIMEOUT_MS"));
+	if (globalMs !== void 0) return globalMs;
+	return DEFAULT_TIMEOUT_MS;
+}
+function parsePositiveInt(raw) {
+	if (!raw) return void 0;
+	const trimmed = raw.trim();
+	if (!/^\d+$/.test(trimmed)) return void 0;
+	const n = Number(trimmed);
+	return Number.isFinite(n) && n > 0 ? n : void 0;
 }
 function detectAzure(baseUrl) {
 	try {
@@ -558,7 +580,7 @@ var OpenRouterProvider = class {
 		return this.call(systemPrompt, userPrompt);
 	}
 	async call(systemPrompt, userPrompt) {
-		const response = await fetch(this.baseUrl, {
+		const response = await fetchWithTimeout(this.baseUrl, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -727,7 +749,7 @@ var GeminiEmbeddingProvider = class {
 		const results = [];
 		for (let i = 0; i < texts.length; i += BATCH_LIMIT) {
 			const chunk = texts.slice(i, i + BATCH_LIMIT);
-			const response = await fetch(`${API_BASE}?key=${this.apiKey}`, {
+			const response = await fetchWithTimeout(`${API_BASE}?key=${this.apiKey}`, {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify({ requests: chunk.map((t) => ({
@@ -816,8 +838,7 @@ var OpenAIEmbeddingProvider = class {
 		return result;
 	}
 	async embedBatch(texts) {
-		const url = `${this.baseUrl}/v1/embeddings`;
-		const response = await fetch(url, {
+		const response = await fetchWithTimeout(`${this.baseUrl}/v1/embeddings`, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.apiKey}`,
@@ -852,7 +873,7 @@ var VoyageEmbeddingProvider = class {
 		return result;
 	}
 	async embedBatch(texts) {
-		const response = await fetch(API_URL$2, {
+		const response = await fetchWithTimeout(API_URL$2, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.apiKey}`,
@@ -888,7 +909,7 @@ var CohereEmbeddingProvider = class {
 		return result;
 	}
 	async embedBatch(texts) {
-		const response = await fetch(API_URL$1, {
+		const response = await fetchWithTimeout(API_URL$1, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.apiKey}`,
@@ -926,7 +947,7 @@ var OpenRouterEmbeddingProvider = class {
 		return result;
 	}
 	async embedBatch(texts) {
-		const response = await fetch(API_URL, {
+		const response = await fetchWithTimeout(API_URL, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.apiKey}`,
@@ -4543,7 +4564,11 @@ function registerContextFunction(sdk, kv, tokenBudget) {
 	sdk.registerFunction("mem::context", async (data) => {
 		const budget = data.budget || tokenBudget;
 		const blocks = [];
-		const [pinnedSlots, profile] = await Promise.all([isSlotsEnabled() ? listPinnedSlots(kv).catch(() => []) : Promise.resolve([]), kv.get(KV.profiles, data.project).catch(() => null)]);
+		const [pinnedSlots, profile, lessons] = await Promise.all([
+			isSlotsEnabled() ? listPinnedSlots(kv).catch(() => []) : Promise.resolve([]),
+			kv.get(KV.profiles, data.project).catch(() => null),
+			kv.list(KV.lessons).catch(() => [])
+		]);
 		const slotContent = renderPinnedContext(pinnedSlots);
 		if (slotContent) blocks.push({
 			type: "memory",
@@ -4567,6 +4592,24 @@ function registerContextFunction(sdk, kv, tokenBudget) {
 				});
 			}
 		}
+		const relevantLessons = lessons.filter((l) => !l.deleted && (!l.project || l.project === data.project)).sort((a, b) => {
+			const scoreA = (a.project === data.project ? 1.5 : 1) * a.confidence;
+			return (b.project === data.project ? 1.5 : 1) * b.confidence - scoreA;
+		}).slice(0, 10);
+		if (relevantLessons.length > 0) {
+			const lessonsContent = `## Lessons Learned\n${relevantLessons.map((l) => `- (${l.confidence.toFixed(2)}) ${l.content}${l.context ? ` — ${l.context}` : ""}`).join("\n")}`;
+			const mostRecent = relevantLessons.reduce((acc, l) => {
+				const t = new Date(l.lastReinforcedAt || l.updatedAt).getTime();
+				return t > acc ? t : acc;
+			}, 0);
+			blocks.push({
+				type: "memory",
+				content: lessonsContent,
+				tokens: estimateTokens$1(lessonsContent),
+				recency: mostRecent,
+				sourceIds: relevantLessons.map((l) => l.id)
+			});
+		}
 		const sessions = (await kv.list(KV.sessions)).filter((s) => s.project === data.project && s.id !== data.sessionId).sort((a, b) => new Date(b.startedAt).getTime() - new Date(a.startedAt).getTime()).slice(0, 10);
 		const summariesPerSession = await Promise.all(sessions.map((s) => kv.get(KV.summaries, s.id).catch(() => null)));
 		const sessionsNeedingObs = [];
@@ -5389,6 +5432,46 @@ const DEFAULTS$1 = {
 	lowImportanceThreshold: 3,
 	maxObservationsPerProject: 1e4
 };
+function isValidRecoveryResult(result) {
+	if (!result || typeof result !== "object") return false;
+	if (!("success" in result)) return true;
+	return result.success !== false;
+}
+function isCompressedObservation(observation) {
+	return "title" in observation && typeof observation.title === "string" && observation.title.length > 0;
+}
+async function recoverStaleSession(sdk, sessionId) {
+	try {
+		const result = await sdk.trigger({
+			function_id: "event::session::stopped",
+			payload: { sessionId }
+		});
+		if (!isValidRecoveryResult(result)) {
+			logger.warn("Stale session recovery failed", {
+				sessionId,
+				result
+			});
+			return false;
+		}
+		return true;
+	} catch (err) {
+		logger.warn("Stale session recovery failed", {
+			sessionId,
+			error: err instanceof Error ? err.message : String(err)
+		});
+		return false;
+	}
+}
+async function runRecoveredSessionConsolidation(sdk) {
+	try {
+		await sdk.trigger({
+			function_id: "mem::consolidate-pipeline",
+			payload: { tier: "all" }
+		});
+	} catch (err) {
+		logger.warn("Recovered session consolidation failed", { error: err instanceof Error ? err.message : String(err) });
+	}
+}
 function registerEvictFunction(sdk, kv) {
 	sdk.registerFunction("mem::evict", async (data) => {
 		const dryRun = data?.dryRun ?? false;
@@ -5407,6 +5490,7 @@ function registerEvictFunction(sdk, kv) {
 			nonLatestMemories: 0,
 			dryRun
 		};
+		let recoveredStaleSessions = 0;
 		const sessions = await kv.list(KV.sessions).catch(() => []);
 		const summaries = await kv.list(KV.summaries).catch(() => []);
 		const summaryIds = new Set(summaries.map((s) => s.sessionId));
@@ -5414,6 +5498,23 @@ function registerEvictFunction(sdk, kv) {
 			if (!session.startedAt) continue;
 			if (now - new Date(session.startedAt).getTime() > cfg.staleSessionDays * MS_PER_DAY$1 && !summaryIds.has(session.id)) if (dryRun) stats.staleSessions++;
 			else {
+				const observations = await kv.list(KV.observations(session.id)).catch((err) => {
+					logger.warn("Stale session observation scan failed", {
+						sessionId: session.id,
+						error: err instanceof Error ? err.message : String(err)
+					});
+					return null;
+				});
+				if (!observations) continue;
+				let recovered = false;
+				if (observations.some(isCompressedObservation)) {
+					recovered = await recoverStaleSession(sdk, session.id);
+					if (!recovered) continue;
+					recoveredStaleSessions++;
+				} else if (observations.length > 0) {
+					logger.warn("Stale session has no compressed observations", { sessionId: session.id });
+					continue;
+				}
 				try {
 					await kv.delete(KV.sessions, session.id);
 					stats.staleSessions++;
@@ -5427,11 +5528,12 @@ function registerEvictFunction(sdk, kv) {
 				}
 				await recordAudit(kv, "delete", "mem::evict", [session.id], {
 					resource: "session",
-					reason: "stale_session_without_summary",
+					reason: recovered ? "stale_session_recovered_then_evicted" : "stale_session_without_summary",
 					dryRun
 				});
 			}
 		}
+		if (!dryRun && recoveredStaleSessions > 0) await runRecoveredSessionConsolidation(sdk);
 		const projectObs = /* @__PURE__ */ new Map();
 		for (const session of sessions) {
 			const compressed = (await kv.list(KV.observations(session.id)).catch(() => [])).filter((o) => o.title);
@@ -6110,7 +6212,7 @@ function registerAutoForgetFunction(sdk, kv) {
 
 //#endregion
 //#region src/version.ts
-const VERSION = "0.9.17";
+const VERSION = "0.9.18";
 
 //#endregion
 //#region src/functions/export-import.ts
@@ -6245,7 +6347,8 @@ function registerExportImportFunction(sdk, kv) {
 			"0.9.14",
 			"0.9.15",
 			"0.9.16",
-			"0.9.17"
+			"0.9.17",
+			"0.9.18"
 		]).has(importData.version)) return {
 			success: false,
 			error: `Unsupported export version: ${importData.version}`
@@ -19512,7 +19615,38 @@ function registerMcpEndpoints(sdk, kv, secret) {
 
 //#endregion
 //#region src/viewer/server.ts
+function loadViewerFavicon() {
+	const base = dirname(fileURLToPath(import.meta.url));
+	const candidates = [
+		join(base, "..", "src", "viewer", "favicon.svg"),
+		join(base, "..", "viewer", "favicon.svg"),
+		join(base, "viewer", "favicon.svg")
+	];
+	for (const path of candidates) try {
+		return readFileSync(path);
+	} catch {}
+	return null;
+}
 const ALLOWED_ORIGINS = (process.env.VIEWER_ALLOWED_ORIGINS || "http://localhost:3111,http://localhost:3113,http://127.0.0.1:3111,http://127.0.0.1:3113").split(",").map((o) => o.trim());
+const ALLOWED_HOSTS_OVERRIDE = (process.env.VIEWER_ALLOWED_HOSTS || "").split(",").map((h) => h.trim().toLowerCase()).filter(Boolean);
+function buildAllowedHosts(origins, listenPort) {
+	const hosts = /* @__PURE__ */ new Set();
+	for (const o of origins) try {
+		const parsed = new URL(o);
+		if (parsed.host) hosts.add(parsed.host.toLowerCase());
+	} catch {}
+	hosts.add(`localhost:${listenPort}`);
+	hosts.add(`127.0.0.1:${listenPort}`);
+	hosts.add(`[::1]:${listenPort}`);
+	for (const h of ALLOWED_HOSTS_OVERRIDE) hosts.add(h);
+	return hosts;
+}
+function isHostAllowed(headerHost, allowed) {
+	if (typeof headerHost !== "string") return false;
+	const lower = headerHost.toLowerCase().trim();
+	if (!lower) return false;
+	return allowed.has(lower);
+}
 function corsHeaders(req) {
 	const origin = req.headers.origin || "";
 	const allowed = ALLOWED_ORIGINS.includes(origin) ? origin : ALLOWED_ORIGINS[0];
@@ -19556,7 +19690,17 @@ const MAX_VIEWER_PORT_RETRIES = 10;
 function startViewerServer(port, _kv, _sdk, secret, restPort) {
 	const resolvedRestPort = restPort ?? port - 2;
 	const requestedPort = port;
+	let allowedHosts = null;
 	const server = createServer(async (req, res) => {
+		if (!allowedHosts) {
+			const addr = server.address();
+			allowedHosts = buildAllowedHosts(ALLOWED_ORIGINS, addr && typeof addr === "object" && "port" in addr ? addr.port : port);
+		}
+		if (!isHostAllowed(req.headers.host, allowedHosts)) {
+			res.writeHead(403, { "Content-Type": "text/plain" });
+			res.end("forbidden host");
+			return;
+		}
 		const raw = req.url || "/";
 		const qIdx = raw.indexOf("?");
 		const pathname = qIdx >= 0 ? raw.slice(0, qIdx) : raw;
@@ -19585,6 +19729,20 @@ function startViewerServer(port, _kv, _sdk, secret, restPort) {
 			res.end("viewer not found");
 			return;
 		}
+		if (method === "GET" && pathname === "/favicon.svg") {
+			const favicon = loadViewerFavicon();
+			if (favicon) {
+				res.writeHead(200, {
+					"Content-Type": "image/svg+xml",
+					"Cache-Control": "public, max-age=3600"
+				});
+				res.end(favicon);
+				return;
+			}
+			res.writeHead(404, { "Content-Type": "text/plain" });
+			res.end("favicon not found");
+			return;
+		}
 		try {
 			await proxyToRestApi(resolvedRestPort, pathname, qs, method, req, res, secret);
 		} catch (err) {